Professional Documents
Culture Documents
Report
Volume 10
An in-depth perspective on
software vulnerabilities and exploits,
malicious code threats, and
potentially unwanted software
in 2010. With new data covering
July through December
Microsoft Security Intelligence Report
This document is for informational purposes only. MICROSOFT MAKES NO
WARRANTIES, EXPRESS, IMPLIED, OR STATUTORY, AS TO THE
INFORMATION IN THIS DOCUMENT.
1
Authors
Doug Cavit Michelle Meyer Javier Salido Jossie Tirado Arroyo
Microsoft Trustworthy Microsoft Trustworthy Microsoft Trustworthy Microsoft IT Information
Computing Computing Computing Security and Risk
Management
Joe Faulhaber Daryl Pecelj Christian Seifert
Microsoft Malware Protection Microsoft IT Information Bing Scott Wu
Center Security and Risk Microsoft Malware Protection
Management Frank Simorjay Center
Vinny Gullotto Microsoft Trustworthy
Microsoft Malware Protection Anthony Penta Computing Jeff Williams
Center Microsoft Windows Safety Microsoft Malware Protection
Platform Holly Stewart Center
Jeff Jones Microsoft Malware Protection
Microsoft Trustworthy Tim Rains Center Terry Zink
Computing Microsoft Trustworthy Microsoft Forefront Online
Computing Matt Thomlinson Protection for Exchange
Jimmy Kuo Microsoft Security Response
Microsoft Malware Protection Center
Center
Contributors
Lawren Ahuna Yuhui Huang Don Nguyen Marc Seinfeld
Microsoft IT Information Microsoft Malware Protection Microsoft IT Information Microsoft Malware Protection
Security and Risk Center Security and Risk Center
Management Management
CSS Japan Security Jasmine Sesso
Eva Chow Response Team Price Oden Microsoft Malware Protection
Microsoft IT Information Microsoft Japan Microsoft IT Information Center
Security and Risk Security and Risk
Management John Lambert Management Norie Tamura (GOMI)
Microsoft Security CSS Japan Security Response
Enrique Gonzalez Engineering Center Kathy Phillips Team
Microsoft Malware Protection Microsoft Legal and
Center Eric Leonard Corporate Affairs Gilou Tenebro
Microsoft IT Information Microsoft Malware Protection
Cristin Goodwin Security and Risk Hilda Larina Ragragio Center
Microsoft Legal and Management Microsoft Malware Protection
Corporate Affairs Center
Laura Lemire
Satomi Hayakawa Microsoft Legal and Tareq Saade
CSS Japan Security Response Corporate Affairs Microsoft Malware Protection
Team Center
Ken Malcolmson
Microsoft Trustworthy Richard Saunders
Computing Microsoft Trustworthy
Computing
Charles McColgan
Microsoft ISD
2
Table of Contents
3
Security Breach Trends ................................................................................. 24
Malware and Potentially Unwanted Software .................................................... 27
Global Infection Rates ................................................................................... 27
Operating System Infection Rates.................................................................. 33
Threat Categories.......................................................................................... 36
Threat Categories by Location ................................................................... 37
Threat Families ............................................................................................. 39
Rogue Security Software ............................................................................... 41
Home and Enterprise Threats ....................................................................... 45
Email Threats ................................................................................................... 49
Spam Messages Blocked ................................................................................ 49
Spam Types .................................................................................................. 51
Malicious Websites ........................................................................................... 55
Phishing Sites ............................................................................................... 56
Target Institutions..................................................................................... 57
Global Distribution of Phishing Sites ......................................................... 59
Malware Hosting Sites .................................................................................. 61
Malware Categories ................................................................................... 62
Global Distribution of Malware Hosting Sites ............................................ 65
Drive-By Download Sites .............................................................................. 66
Appendix A: Threat Naming Conventions ........................................................ 69
Appendix B: Data Sources ................................................................................ 71
Microsoft Products and Services ................................................................ 71
Appendix C: Worldwide Infection Rates ........................................................... 73
Glossary ........................................................................................................... 78
Threat Families Referenced in This Report ........................................................ 83
4
About This Report
Scope
The Microsoft® Security Intelligence Report (SIR) focuses on software
vulnerabilities, software vulnerability exploits, malicious and potentially
unwanted software, and security breaches. Past reports and related resources are
available for download at www.microsoft.com/sir. We hope that readers find the
data, insights, and guidance provided in this report useful in helping them
protect their organizations, software, and users.
Reporting Period
In this volume of the Microsoft Security Intelligence Report, statistics about malware
families and infections are reported on a quarterly basis and other statistics
continue to be reported on a half-yearly basis, with a focus on 2010.
Throughout the report, half-yearly and quarterly time periods are referenced
using the nHyy or nQyy formats, respectively, where yy indicates the calendar
year and n indicates the half or quarter. For example, 1H10 represents the first
half of 2010 (January 1 through June 30), and 2Q10 represents the second
quarter of 2010 (April 1 through June 30). To avoid confusion, please pay
attention to the reporting period or periods being referenced when considering
the statistics in this report.
Conventions
This report uses the Microsoft Malware Protection Center (MMPC) naming
standard for families and variants of malware and potentially unwanted software.
For information about this standard, see “Microsoft Malware Protection Center
Naming Standard” on the MMPC website.
5
Key Findings Summary
This document summarizes the key findings of the report. The full SIRv10 also
includes deep analysis of trends found in 117 countries/regions around the world
and offers ways to manage risks to your organization, software, and people.
The full SIRv10, as well as previous volumes of the report and related videos, can
be downloaded from www.microsoft.com/sir.
Vulnerability Disclosures
Vulnerabilities in applications versus operating systems or web browsers
continued to account for a large majority of all vulnerabilities in 2010,
although the total number of application vulnerabilities declined 22.2
percent from 2009.
Exploits
The exploitation of Java vulnerabilities sharply increased in the third
quarter of 2010 and surpassed every other exploitation category that the
6
MMPC tracks, including generic HTML/scripting exploits, operating
system exploits, and document exploits.
Exploits that use HTML and JavaScript steadily increased throughout the
year and continue to represent a large portion of exploits. The most
prevalent type of attack in this category involved malicious IFrames.
The number of Adobe Acrobat and Adobe Reader exploits dropped by
more than half after the first quarter and remained near this reduced
level throughout the remainder of the year.
Infection rates for the 64-bit versions of Windows Vista® and Windows
7 are lower than for the corresponding 32-bit versions of those operating
systems. One reason may be that 64-bit versions of Windows still appeal
to a more technically savvy audience than their 32-bit counterparts,
despite increasing sales of 64-bit Windows versions among the general
computing population. Kernel Patch Protection (KPP), a feature of 64-bit
versions of Windows that protects the kernel from unauthorized
modification, may also contribute to the difference by preventing certain
types of malware from operating.
Threat Families
JS/Pornpop, the most commonly detected family in 4Q10, is a detection
for specially crafted JavaScript-enabled objects that attempt to display
7
pop-under advertisements in users’ web browsers, usually with adult
content.
Email Threats
After increasing gradually and then reaching a plateau through the first
eight months of 2010, the number of spam messages received and
blocked by Microsoft Forefront® Online Protection for Exchange
(FOPE) dropped abruptly in September, and again in December. These
8
drops can be correlated with events involving two of the world’s most
significant spam-sending botnets:
o During the last week of August 2010, researchers affiliated with the
security firm LastLine spearheaded a coordinated takedown of
command-and-control (C&C) servers associated with the
Win32/Cutwail spambot. In the days following the takedown, FOPE
recorded a significant drop in the average daily volume of messages
blocked.
Spam Types
Advertisements for nonsexual pharmaceutical products accounted for
32.4 percent of the spam messages blocked by FOPE content filters in
2010.
Malicious Websites
In the first half of 2010, phishers showed signs of targeting online
gaming sites with increasing frequency, although this push appeared to
have dwindled as social networks came under increased attack.
Impressions that targeted gaming sites reached a high of 16.7 percent of
9
all impressions in June before dropping to a more typical 2.1 percent in
December.
Phishing sites that target social networks routinely receive the highest
number of impressions per active phishing site. The percentage of active
phishing sites that targeted social networks increased during the final
months of the year, but still only accounted for 4.2 percent of active sites
in December, despite receiving 84.5 percent of impressions that month.
Nevertheless, the number of active sites targeting gaming sites remained
relatively high during the second half of the year, which suggests that
more campaigns may be coming.
10
Trustworthy Computing:
Security Engineering at
Microsoft
Amid the increasing complexity of today’s computing threat landscape and the
growing sophistication of criminal attacks, enterprises and governments are more
focused than ever on protecting their computing environments so that they and
their constituents can feel safer online. With more than a billion systems using its
products and services worldwide, Microsoft collaborates with partners, industry,
and governments to help create a safer, more trusted Internet.
11
Vulnerabilities
Vulnerability Severity
The Common Vulnerability Scoring System (CVSS) is a standardized, platform-
independent scoring system for rating IT vulnerabilities. The CVSS assigns a
numeric value between 0 and 10 to vulnerabilities according to severity, with
higher scores representing greater severity. (See Vulnerability Severity in the
“Reference Guide” section of the Security Intelligence Report website for more
information.)
12
Figure 1. Industry-wide vulnerability disclosures by severity, 2006–2010
13
Figure 2. Industry-wide vulnerability disclosures in 2010, by severity
Vulnerability Complexity
Some vulnerabilities are easier to exploit than others, and vulnerability
complexity is an important factor to consider in determining the magnitude of
the threat that a vulnerability poses. A High severity vulnerability that can only
be exploited under very specific and rare circumstances might require less
immediate attention than a lower severity vulnerability that can be exploited
more easily.
14
Figure 3. Industry-wide vulnerabilities by access complexity, 2006–2010
As with vulnerability severity, the trend here is a positive one, with Low
and Medium complexity vulnerability disclosures declining 28.3 percent
and 5.0 percent from 2009, respectively.
15
Figure 4. Industry-wide operating system, browser, and application vulnerabilities, 2006–2010
Vulnerability Disclosures
A disclosure, as the term is used in the SIR, is the revelation of a software
vulnerability to the public at large. It does not refer to any sort of private
disclosure or disclosure to a limited number of people. Disclosures can come
from a variety of sources, including the software vendor itself, security software
vendors, independent security researchers, and even malware creators.
16
Figure 5 charts vulnerability disclosures for Microsoft and non-Microsoft
products since 2006.
17
Exploits
Figure 6 shows the prevalence of different types of exploits for each quarter in
2010.
18
Figure 6. Exploits detected by Microsoft desktop antimalware products in 2010, by targeted platform or technology
Malware written in Java has existed for many years, but attackers had not
focused significant attention on exploiting Java vulnerabilities until
somewhat recently. In 3Q10, the number of Java attacks increased to
fourteen times the number of attacks recorded in 2Q10, driven mostly
by the exploitation of a pair of vulnerabilities in versions of the Sun (now
Oracle) JVM, CVE-2008-5353 and CVE-2009-3867. Together, these two
vulnerabilities accounted for 85 percent of the Java exploits detected in
the second half of 2010.
Operating system exploits, which have been less prevalent than other
types of exploits for several years, increased significantly in 3Q10,
primarily because of exploitation of two Windows® vulnerabilities.
19
HTML and JScript/JavaScript Exploits
Figure 7 shows the prevalence of different types of HTML and
Jscript®/JavaScript exploits each quarter in 2010.
Figure 7. Types of HTML and JScript/JavaScript exploits detected by Microsoft desktop antimalware products in 2010
20
Document Exploits
Figure 8 shows the prevalence of different types of document format exploits by
quarter in 2010.2
Figure 8. Types of document exploits detected by Microsoft desktop antimalware products in 2010
Exploits that affected Adobe Acrobat and Adobe Reader accounted for
most document format exploits detected throughout 2010. Almost all of
these exploits involved the generic exploit family Win32/Pdfjsc.
Adobe Acrobat and Adobe Reader exploits dropped by more than half
after the first quarter and remained near this reduced level throughout
the remainder of the year.
Microsoft Office file format exploits accounted for between 0.5 and 2.8
percent of the document format exploits that were detected each quarter
in 2010.
2 Microsoft also detected a very small number of exploits that affect JustSystems Ichitaro, a Japanese-language
word processing program. These exploits affected fewer than 200 computers each quarter and are not shown in
the figure.
21
Operating System Exploits
Figure 9 shows the prevalence of different operating system exploits by quarter in
2010.
Figure 9. Operating system exploits detected by Microsoft desktop antimalware products in 2010
Several of the operating system exploits with the most detections in 2010
were caused by worms that spread in ways that result in large numbers
of detections on each computer they try to infect. Figure 9 provides
another perspective on these statistics, and shows the number of
individual computers that reported exploit attempts for several of these
exploits, in addition to the total number of detections.
Operating system exploits had been declining for several years prior to
2010, and detections numbered less than 200,000 in each of the first two
quarters of the year. This decline changed in 3Q10 with the discovery
and publication of two zero-day exploits (exploits that take advantage of
undisclosed or newly disclosed vulnerabilities before the vendor releases
security updates for them) for two vulnerabilities that affect Windows,
CVE-2010-1885 and CVE-2010-2568.
22
Microsoft detected a relatively small number of exploits targeting CVE-
2010-1885 (fewer than 14,000 worldwide) in 2Q10, followed by a steep
rise to more than 250,000 detections in the third quarter. By the end of
the year, exploitation had declined significantly, with fewer than 65,000
detections in 4Q10.
For additional information, see the post Attacks on the Windows Help
and Support Center Vulnerability (CVE-2010-1885) (June 30, 2010) on
the MMPC blog, http://blogs.technet.com/mmpc.
23
a worm traversing a network may make repeated attempts to infect an
individual computer using the exploit, with each unsuccessful attempt
logged as a separate detection.
In general, successful exploitation of operating system vulnerabilities as
old as CVE-2006-3439 should be rare, as most of the Windows
installations that were initially affected have since been updated with the
appropriate security updates or service packs or replaced by newer
versions of Windows that are not affected by the vulnerability. In 2010,
detections of CVE-2006-3439 exploits were strongly correlated with
detections of the uncommon Trojan family Win32/ServStart, suggesting a
possible connection between the two.
The information in this section was generated from worldwide data security
breach reports from news media outlets and other information sources that
volunteers have recorded in the Data Loss Database (DataLossDB) at
http://datalossdb.org. (See Security Breach Trends in the “Reference Guide”
section of the Security Intelligence Report website for more information about the
DataLossDB and the breach types referenced here.)
24
Figure 10. Security breach incidents by incident type, 3Q09–4Q10
The largest single category of incidents in each of the past six quarters
involved stolen equipment, ranging from a high of 34.5 percent of the
total in 3Q09 to a low of 18.6 percent of the total in 4Q10.
25
Figure 11. Breach incidents resulting from attacks and negligence, 3Q09–4Q10
26
Malware and Potentially
Unwanted Software
Except where specified, the information in this section was compiled from
telemetry data that was generated from more than 600 million computers
worldwide and some of the busiest Internet online services. (See “Appendix B:
Data Sources” on page 71 for more information about the telemetry used in this
report.)
Chg. 3Q
Country/Region 1Q10 2Q10 3Q10 4Q10
to 4Q
1 United States 11,025,811 9,609,215 11,340,751 11,817,437 4.2% ▲
-2.1%
2 Brazil 2,026,578 2,354,709 2,985,999 2,922,695
▼
-8.6%
3 China 2,168,810 1,943,154 2,059,052 1,882,460
▼
18.9%
5 United Kingdom 1,490,594 1,285,570 1,563,102 1,857,905
▲
12.1%
4 France 1,943,841 1,510,857 1,601,786 1,794,953
▲
56.8%
7 Korea 962,624 1,015,173 1,070,163 1,678,368
▲
-3.9%
6 Spain 1,358,584 1,348,683 1,588,712 1,526,491
▼
27
Chg. 3Q
Country/Region 1Q10 2Q10 3Q10 4Q10
to 4Q
41.3%
9 Russia 700,685 783,210 928,066 1,311,665
▲
10.6%
8 Germany 949,625 925,332 1,177,414 1,302,406
▲
10.8%
10 Italy 836,593 794,099 900,964 998,458
▲
Detections in Korea rose 56.8 percent from 3Q10 to 4Q10, with three
families—Win32/Onescan, Win32/Parite, and Win32/Nbar—
representing 77 percent of the 3Q–4Q increase. Onescan, a Korean-
language rogue security software family first detected in 4Q10, was itself
responsible for about 32 percent of all detections in Korea. (For more
information, see “Rogue Security Software” on page 41.)
Figure 13. False malware detections by Win32/Onescan, a Korean-language rogue security software family
28
Detections in Russia rose 41.3 percent from 3Q to 4Q, primarily because
of a significant increase in the number of computers running Microsoft
Security Essentials there.
In absolute terms, the locations with the most computers reporting detections
tend to be ones with large populations and large numbers of computers. To
control for this effect, Figure 14 shows the infection rates in locations around the
world using a metric called computers cleaned per mille (thousand), or CCM,
which represents the number of reported computers cleaned in a quarter for
every 1,000 executions of the Microsoft Windows® Malicious Software Removal
Tool (MSRT).3 (See the Security Intelligence Report website for more information
about the CCM metric.)
Figure 14. Infection rates by country/region in 1H10 (top) and 2H10 (bottom), by CCM
3 For the maps in Figure 14, the CCM totals are averaged for the first two and last two quarters of 2010,
respectively, to produce CCM totals for 1H10 and 2H10.
29
Among locations with at least 100,000 executions of MSRT in 4Q10,
Korea had the highest infection rate, with 40.3 computers cleaned for
every 1,000 MSRT executions (CCM 40.3). Following Korea were Spain
(33.2), Turkey (32.8), Taiwan (24.3), and Brazil (20.8).
For the entire year, Turkey had the highest average quarterly CCM at
36.8, followed by Spain (36.1), Korea (34.8), Taiwan (29.7), and Brazil
(24.7). These five locations have consistently had the highest infection
rates among large countries and regions for most of the past six quarters,
as shown in Figure 15 on page 31.
Locations with low infection rates include Mongolia (1.3 average CCM
for 2010), Bangladesh (1.4), and Belarus (1.6). Large countries and
regions with low infection rates include the Philippines (3.1), Austria
(3.4), India (3.8), and Japan (4.4).
The next two figures illustrate infection rate trends for specific locations around
the world, relative to the trends for all locations with at least 100,000 MSRT
executions each quarter in 2010. (See Infection Trends Worldwide in the “Key
30
Findings” section of the Security Intelligence Report website for additional details
about this information.)
Figure 15. Trends for the five locations with the highest infection rates in 4Q10, by CCM (100,000 MSRT executions
minimum per quarter in 2010)
Korea, Spain, Turkey, Taiwan, and Brazil have occupied the top five
spots among large countries and regions with the highest infection rates
in all but one of the last six quarters (the sole exception being 4Q09,
when Portugal edged Korea for 5th place).
31
Figure 16. Infection rate trends for the five most improved locations between 4Q09 and 4Q10, by CCM (100,000 MSRT
executions minimum in 4Q10)
The most improved locations are those that showed the greatest decline
in CCM between 4Q09 and 4Q10.
Brazil, though still one of the locations with the highest infection rates,
has improved significantly over the past six quarters, dropping from 30.1
CCM in 3Q09 to 20.8 in 4Q10. Declines in Win32/Frethog and
Win32/Hamweq were chiefly responsible for this improvement, followed
by declines in Win32/Conficker and Win32/Rimecud. (See “Threat
Families” on page 39 for more information about these and other
malware families.)
Infection rates in Portugal and Bahrain fluctuated over the past six
quarters, but both locations ended 4Q10 showing significant
improvements over 3Q09. Portugal went from 25.0 CCM to 15.6, a 37.6
32
percent decrease. Bahrain dropped from 13.6 to 9.0, a decline of 33.8
percent.
33
Figure 17. Average quarterly infection rate (CCM) by operating system and service pack in 2010
“32” = 32-bit; “64” = 64-bit. Supported systems with at least 0.1 percent of total executions shown.
This data is normalized: the infection rate for each version of Windows is
calculated by comparing an equal number of computers per version (for
example, 1,000 Windows XP SP2 computers to 1,000 Windows 7 RTM
computers).
Infection rates for the 64-bit versions of Windows Vista® and Windows
7 are lower than for the corresponding 32-bit versions of those operating
systems. One reason may be that 64-bit versions of Windows still appeal
to a more technically savvy audience than their 32-bit counterparts,
despite increasing sales of 64-bit Windows versions among the general
computing population. Kernel Patch Protection (KPP), a feature of 64-bit
versions of Windows that protects the kernel from unauthorized
modification, may also contribute to the discrepancy by preventing
certain types of malware from operating.
34
Figure 18. CCM trends for supported 32-bit versions of Windows XP, Windows Vista, and Windows 7, 3Q09-4Q10
35
Threat Categories
The Microsoft Malware Protection Center (MMPC) classifies individual threats
into types based on a number of factors, including how the threat spreads and
what it is designed to do. To simplify the presentation of this information and
make it easier to understand, the SIR groups these types into 10 categories based
on similarities in function and purpose.
Figure 19. Detections by threat category each quarter in 2010, by percentage of all computers reporting detections
Round markers indicate malware categories; square markers indicate potentially unwanted software categories.
Totals for each time period may exceed 100 percent because some
computers have more than one category of threat detected and removed
from them in each time period.
The miscellaneous trojans category, which consists of all trojans that are
not categorized as trojan downloaders & droppers, was the most
prevalent category each quarter in 2010, with detections on 20.0 percent
of all infected computers in 4Q10, down from 22.7 percent in 1Q10.
36
Win32/ClickPotato, in the third quarter. (See “Threat Families” on page
39 for more information about these and other families.)
37
Figure 20 shows the relative prevalence of different categories of malware and
potentially unwanted software in several locations around the world in 2010.
Figure 20. Threat category prevalence worldwide and in nine individual locations in 2010
Russi
Category World US Brazil China UK Fr. Spain Ger. Korea
a
43.4 23.2 28.0 36.5 21.6 20.1 40.3 28.4 17.3
Misc. Trojans 31.6%
% % % % % % % % %
Misc. Potentially 22.6 31.2 52.1 23.6 24.3 22.6 33.8 24.5 10.3
25.5%
Unwanted Software % % % % % % % % %
16.6 35.6 13.5 11.8 21.0 40.2 32.8 14.4 40.1
Worms 24.4%
% % % % % % % % %
Trojan Downloaders 20.2 26.2 18.8 20.3 19.7 16.9 17.0 28.9
20.1% 8.0%
& Droppers % % % % % % % %
21.4 29.3 33.0 10.7 16.3 12.1
Adware 17.4% 9.4% 3.4% 8.2%
% % % % % %
Password Stealers 27.9 10.7 20.5 10.3 14.7
11.7% 6.1% 7.5% 9.2% 9.3%
& Monitoring Tools % % % % %
10.5 13.5
Exploits 7.1% 9.6% 7.3% 2.7% 3.0% 8.0% 5.7% 3.3%
% %
10.3
Backdoors 6.6% 5.3% 5.7% 4.2% 4.4% 8.4% 8.2% 5.1% 7.1%
%
10.3 12.1 13.8
Viruses 5.9% 5.1% 6.1% 3.4% 3.3% 3.7% 3.2%
% % %
Spyware 0.6% 0.7% 0.2% 2.3% 0.4% 0.3% 0.2% 0.5% 0.7% 0.5%
Totals for each location exceed 100 percent because some computers reported threats from more than one category.
Within each row of Figure 20, a darker color indicates that the category
is more prevalent in the specified location than in the others, and a
lighter color indicates that the category is less prevalent.
The United States and the United Kingdom, two predominantly English-
speaking locations that also share a number of other cultural similarities,
have similar threat mixes in most categories. Exceptions include Adware,
which is more common in the UK, and Worms, which are more
common in the US.
38
China has a relatively high concentration of Miscellaneous Potentially
Unwanted Software, Exploits, Backdoors, and Spyware, and a relatively
low concentration of Worms and Adware. China routinely exhibits a
threat mix that is much different than those of other large countries and
regions. Two of the most common threats in China, Win32/BaiduSobar
and Win32/Sogou, are Chinese-language potentially unwanted software
families that are uncommon elsewhere. The most common families in
China also include a pair of exploits, JS/CVE-2010-0806 and
JS/ShellCode, that were less prevalent elsewhere.
Worms and Backdoors are unusually common in Spain. The top six
families detected in Spain in 2010 were worms.
The threat mix in Russia resembles that of the world as a whole, with the
exception of an unusually low concentration of Adware, perhaps because
of the highly language-dependent nature of online advertising.
Threat Families
Figure 21 lists the top 10 malware and potentially unwanted software families
that were detected on computers by Microsoft desktop security products in the
second half of 2010.
39
Figure 21. Quarterly trends for the top 10 malware and potentially unwanted software families detected by Microsoft
desktop security products in 2H10
Figure 22. The families that increased the most in prevalence in 2010
40
Pornpop is one of the fastest spreading malware families seen in several
years. First detected in August 2010, it quickly grew to become the
second most prevalent family in 3Q10, and the most prevalent family in
4Q10 and in the second half of the year as a whole.
41
legitimate security software programs and claim to detect a large number of
nonexistent threats while urging users to pay for the “full version” of the software
to remove the threats. Attackers typically install rogue security software programs
through exploits or other malware or use social engineering to trick users into
believing the programs are legitimate and useful. Some versions emulate the
appearance of the Windows Security Center or unlawfully use trademarks and
icons to misrepresent themselves. (See Rogue Security Software in the “Reference
Guide” section of the Security Intelligence Report website for more information
about this kind of threat. Also see
www.microsoft.com/security/antivirus/rogue.aspx for an informative series of
videos about rogue security software aimed at a general audience.)
Figure 23. Some of the “brands” used by different versions of the rogue security software family
Win32/FakeXPA
Figure 24 shows detection trends for the most common rogue security software
families detected in 2010.
42
Figure 24. Trends for the most commonly detected rogue security software families in 2010, by quarter
43
(actually another part of FakePAV itself), after which it proceeds in a
manner similar to other rogue security software programs.
Figure 25. A genuine Microsoft Security Essentials alert (top) and a fake alert generated by
Win32/FakePAV (bottom)
44
Home and Enterprise Threats
The usage patterns of home users and enterprise users tend to be very different.
Enterprise users typically use computers to perform business functions while
connected to a network, and may have limitations placed on their Internet and
email usage. Home users are more likely to connect to the Internet directly or
through a home router and to use their computers for entertainment purposes,
such as playing games, watching videos, and communicating with friends. These
different usage patterns mean that home users tend to be exposed to a different
mix of computer threats than enterprise users.
Figure 26 and Figure 27 list the top 10 families detected on domain-joined and
non-domain computers in 4Q10.
45
Figure 26. Top 10 families detected on domain-joined computers in 2010, by percentage of domain-joined computers
reporting detections
46
Figure 27. Top 10 families detected on non-domain computers in 2010, by percentage of all infected non-domain
computers reporting detections
Family Category Q1 Q2 Q3 Q4
1 Win32/Renos Trojan Downloaders & Droppers 8.8% 6.6% 6.1% 4.6%
2 Win32/Autorun Worms 3.8% 5.4% 7.8% 8.7%
3 Win32/Taterf Worms 4.8% 8.0% 6.7% 4.4%
4 Win32/Rimecud Worms 5.6% 5.7% 4.6% 5.0%
5 Win32/Frethog Password Stealers & Monitoring Tools 6.4% 6.9% 3.6% 3.4%
6 JS/Pornpop Adware — — 7.8% 10.4%
7 Win32/FakeSpypro Miscellaneous Trojans 4.1% 4.9% 5.6% 2.5%
8 Win32/Conficker Worms 3.8% 4.7% 3.9% 3.8%
9 Win32/Zwangi Miscellaneous Potentially Unwanted Software 1.8% 3.1% 4.9% 6.4%
1
Win32/Hotbar Adware 3.4% 5.3% 2.8% 4.6%
0
Seven families are common to both lists, although they are ordered
differently and in different proportions. The worm family
Win32/Conficker, which uses several methods of propagation that work
more effectively within a typical enterprise network environment than
they do over the public Internet, leads the domain-joined list by a
significant margin, but ranks ninth on the non-domain list.
47
Worms accounted for five of the top 10 families detected on domain-
joined computers. Several of these worms, including Conficker,
Win32/Autorun, and Win32/Taterf, are designed to propagate via
network shares, which are common in domain environments.
Taterf and Win32/Frethog are two related families that are designed to
steal the passwords of users who play massively multiplayer online role-
playing games (MMORPGs). Such games are not common in the
workplace, yet both families were detected with similar frequency on
both domain-joined and non-domain computers. Taterf and Frethog
both rely heavily on removable drives to propagate—a technique that
was probably developed to help spread them in Internet cafés and public
gaming centers, but one that has had the effect of spreading them
efficiently in enterprise environments as well, which was perhaps
unexpected.
48
Email Threats
Most of the email messages sent over the Internet are unwanted. Not only does
all this unwanted email tax recipients’ inboxes and the resources of email
providers, but it also creates an environment in which emailed malware attacks
and phishing attempts can proliferate. Email providers, social networks, and
other online communities have made blocking spam, phishing, and other email
threats a top priority.
49
After increasing gradually and then reaching a plateau through the first
eight months of 2010, the number of spam messages received and
blocked by FOPE dropped abruptly in September, and again in
December. These drops can be correlated with events involving two of
the world’s most significant spam-sending botnets:
FOPE performs spam filtering in two stages. Most spam is blocked by servers at
the network edge, which use reputation filtering and other non-content-based
rules to block spam or other unwanted messages. Messages that are not blocked
at the first stage are scanned using content-based rules, which detect and filter
many additional email threats, including attachments that contain malware.
50
Figure 29. Percentage of incoming messages blocked by FOPE using edge-blocking and content filtering in 2010
In 2010 overall, only about one out of every 38.5 incoming messages
made it to recipients’ inboxes. The rest were blocked at the network edge
or through content filtering.
Spam Types
The FOPE content filters recognize several different common types of spam
messages. Figure 30 shows the relative prevalence of these spam types in 2010.
51
Figure 30. Inbound messages blocked by FOPE filters in 2010, by category
52
Figure 31. Inbound messages blocked by FOPE content filters each month in 2010, by category
53
Nonsexual pharmaceutical ads and nonpharmaceutical product ads were
the most highly ranked categories by a significant margin throughout
most of 2010.
54
Malicious Websites
The information in this section is compiled from a variety of internal and external
sources, including telemetry data produced by the SmartScreen® filter (in
Windows® Internet Explorer® 8 and 9), the Phishing Filter (in Internet Explorer
7), from a database of known active phishing and malware hosting sites reported
by users of Internet Explorer and other Microsoft® products and services, and
from malware data provided by Microsoft antimalware technologies. (See
Phishing and Malware Hosts in the “Reference Guide” section of the Security
Intelligence Report website for more information.)
55
Figure 32. The SmartScreen filter in Internet Explorer 8 and 9 blocks reported phishing and malware
distribution sites
Phishing Sites
Figure 33 compares the volume of active phishing sites in the SmartScreen
database each month with the volume of phishing impressions tracked by Internet
Explorer. A phishing impression is a single instance of a user attempting to visit a
known phishing site with Internet Explorer and being blocked.
56
Figure 33. Phishing sites and impressions tracked each month in 2010, relative to the monthly average for each
Sudden sharp spikes in impressions like the one shown in June are not
unusual. Phishers often engage in discrete campaigns that are intended to
drive more traffic to each phishing page, without necessarily increasing
the total number of active phishing pages they are maintaining at the
same time. In this case, the June increase is not strongly correlated with
increases in any particular type of target institution.
Target Institutions
Figure 34 and Figure 35 show the percentage of phishing impressions and active
phishing sites, respectively, recorded by Microsoft during each month in 2010
for the most frequently targeted types of institutions.
57
Figure 34. Impressions for each type of phishing site each month in 2010
Figure 35. Active phishing sites tracked each month in 2010, by type of target
Phishers have traditionally targeted financial sites more than other types
of sites, but 2010 showed evidence of a shift to social networks. Phishing
impressions that targeted social networks increased from a low of 8.3
percent of all impressions in January to a high of 84.5 percent of
impressions in December. In particular, the final four months of the year
58
show signs of a strong and sustained phishing campaign or campaigns
against social networks.
Phishing sites that target social networks routinely receive the highest
number of impressions per active phishing site. The percentage of active
phishing sites that targeted social networks increased during the final
months of the year, but still only accounted for 4.2 percent of active sites
in December, despite receiving 84.5 percent of impressions that month.
Nevertheless, the number of active sites targeting gaming sites remained
relatively high during the second half of the year, which suggests that
more campaigns may be coming.
59
Figure 36. Phishing sites per 1,000 Internet hosts for locations around the world in 1H10 (top) and 2H10 (bottom)
Phishing sites are concentrated in a few locations but have been detected
on every inhabited continent.
Locations with smaller populations and fewer Internet hosts tend to have
higher concentrations of phishing pages, although in absolute terms most
60
phishing pages are located in large, industrialized countries/regions with
large numbers of Internet hosts.
61
Figure 38. Malware hosting sites and impressions tracked each month in 2010, relative to the monthly average for each
After a rising trend during the first five months, the number of malware
hosting impressions decreased each month for the rest of the year.
Malware host protection in browsers is a relatively new development
compared to phishing protection, and it is possible that attackers are
reacting by moving away from this method of distribution to other
techniques.
Malware Categories
Figure 39 and Figure 40 show the types of threats hosted at URLs that were
blocked by the SmartScreen filter in 2H10.
62
Figure 39. Threats hosted at URLs blocked by the SmartScreen filter in 2010, by category
63
Figure 40. The top 10 malware families hosted on sites blocked by the SmartScreen filter in 1H10 and 2H10, by percent of
all such sites
Overall, sites that hosted the top 10 families constituted 76.9 percent of
all malware impressions in the first half of the year and 71.6 percent in
the second half.
64
collections of unrelated threats that share certain identifiable
characteristics.
Figure 41. Malware distribution sites per 1,000 Internet hosts for locations around the world in 1H10 (top) and 2H10
(bottom)
65
As with phishing sites, the worldwide distribution of sites that host
malware remained largely consistent between periods.
The information in this section was generated from an analysis of the country
code top-level domains (ccTLDs) of the websites in the Bing index that hosted
drive-by download pages in 2010.
66
Figure 42. Percentage of websites in each country-code top-level domain (ccTLD) that hosted drive-by pages in 2Q10
(top) and 4Q10 (bottom)
Overall, the most heavily infected ccTLDs were small ones. Small TLDs
are susceptible to large swings in infection rates because of their size. For
example, if a major ISP in a small country or region were to become
compromised by an attacker, a large percentage of the domains in the
associated ccTLD could be affected.
67
Figure 42 does not reflect the physical locations of hosted sites; not all
ccTLD sites are hosted in the locations to which the ccTLDs themselves
are assigned. However, most ccTLD sites are targeted at Internet users in
a particular country/region and are typically written in an appropriate
language, so Figure 42 can be considered a reasonable indicator of how
users in different parts of the world are more or less at risk of
encountering drive-by download pages.
68
Appendix A: Threat Naming
Conventions
The MMPC malware naming standard is derived from the Computer Antivirus
Research Organization (CARO) Malware Naming Scheme, originally published in
1991 and revised in 2002. Most security vendors use naming conventions that
are based on the CARO scheme, with minor variations, although family and
variant names for the same threat can differ between vendors.
A threat name can contain some or all of the components seen in Figure 43.
Figure 43. The Microsoft malware naming convention
The type indicates the primary function or intent of the threat. The MMPC
assigns each individual threat to one of a few dozen different types based on a
number of factors, including how the threat spreads and what it is designed to
do. To simplify the presentation of this information and make it easier to
understand, the Security Intelligence Report groups these types into 10 categories.
For example, the TrojanDownloader and TrojanDropper types are combined into
a single category, called Trojan Downloaders & Droppers.
The platform indicates the operating environment in which the threat is designed
to run and spread. For most of the threats described in this report, the platform
is listed as “Win32,” for the Win32 API used by 32-bit and 64-bit versions of
Windows desktop and server operating systems. (Not all Win32 threats can run
on every version of Windows, however.) Platforms can include programming
languages and file formats, in addition to operating systems. For example, threats
in the ASX/Wimad family are designed for programs that parse the Advanced
Stream Redirector (ASX) file format, regardless of operating system.
Groups of closely related threats are organized into families, which are given
unique names to distinguish them from others. The family name is usually not
69
related to anything the malware author has chosen to call the threat. Researchers
use a variety of techniques to name new families, such as excerpting and
modifying strings of alphabetic characters found in the malware file. Security
vendors usually try to adopt the name used by the first vendor to positively
identify a new family, although sometimes different vendors use completely
different names for the same threat, which can happen when two or more
vendors discover a new family independently. The MMPC Encyclopedia
(www.microsoft.com/mmpc) lists the names used by other major security
vendors to identify each threat, when known.
Some malware families include multiple components that perform different tasks
and are assigned different types. For example, the Win32/Frethog family includes
variants designated PWS:Win32/Frethog.C and
TrojanDownloader:Win32/Frethog.C, among others. In the Security Intelligence
Report, the category listed for a particular family is the one that Microsoft security
analysts have determined to be the most significant category for the family
(which, in the case of Frethog, is Password Stealers & Monitoring Tools).
Malware creators often release multiple variants for a family, typically in an effort
to avoid being detected by security software. Variants are designated by letters,
which are assigned in order of discovery—A through Z, then AA through AZ,
then BA through BZ, and so on. A variant designation of “gen” indicates that the
threat was detected by a generic signature for the family rather than as a specific
variant. Any additional characters that appear after the variant provide comments
or additional information.
70
Appendix B: Data Sources
Bing, the search and decision engine from Microsoft, contains technology
that performs billions of webpage scans per year to seek out malicious
content. Once detected, Bing displays warnings to users about the
malicious content to help prevent infection.
71
because of its lack of real-time protection and because it uses only the
portion of the Microsoft antivirus signature database that enables it to
target specifically selected, prevalent malicious software.
72
Appendix C: Worldwide
Infection Rates
“Global Infection Rates,” on page 27, explains how threat patterns differ
significantly in different parts of the world. Figure 44 shows the infection rates in
locations with at least 100,000 quarterly MSRT executions in 2010. (CCM is the
number of computers cleaned for every 1,000 executions of MSRT. See the
Security Intelligence Report website for more information about the CCM metric.)
Figure 44. Infection rates (CCM) for locations around the world in 2010, by quarter
73
Country/Region 1Q10 2Q10 3Q10 4Q10
Cameroon 3.9 3.2 3.3 2.8
Canada 5.2 4.5 4.9 4.2
Chile 12.9 12.9 14.9 12.5
China 8.1 5.5 4.5 2.9
Colombia 16.0 13.5 12.6 10.0
Costa Rica 16.4 12.6 11.9 13.2
Côte d’Ivoire 3.9 2.3 2.4 1.8
Croatia 20.4 15.8 14.1 13.4
Cyprus 9.9 9.3 9.0 7.9
Czech Republic 7.1 5.5 6.2 8.0
Denmark 6.0 4.1 4.9 3.9
Dominican Republic 8.9 7.4 7.9 6.9
Ecuador 17.3 12.9 12.0 8.9
Egypt 9.7 9.0 10.0 11.4
El Salvador 20.6 20.5 19.1 15.2
Estonia 11.9 6.0 8.1 5.9
Ethiopia — — 1.3 1.0
Finland 3.7 2.1 3.8 2.3
France 15.5 12.4 12.8 9.8
Georgia 7.9 7.1 7.7 7.3
Germany 5.5 4.6 5.6 5.3
Ghana 2.9 1.6 1.5 1.2
Greece 18.7 15.4 17.5 14.0
Guadeloupe 3.5 3.0 3.6 2.8
Guatemala 16.1 13.3 13.2 10.2
Honduras 14.8 12.6 13.9 11.0
Hong Kong S.A.R. 9.4 9.1 8.8 6.3
Hungary 19.4 15.2 14.9 11.1
Iceland 12.5 7.7 7.1 5.9
India 4.6 3.4 4.1 3.2
Indonesia 3.2 2.7 10.8 7.1
Iraq 7.2 6.7 9.8 10.0
Ireland 7.6 6.4 7.3 6.2
Israel 15.2 12.2 13.6 11.0
74
Country/Region 1Q10 2Q10 3Q10 4Q10
Italy 12.0 9.7 10.3 8.9
Jamaica 5.4 3.7 3.6 2.5
Japan 5.1 4.4 4.6 3.3
Jordan 8.6 7.4 8.4 8.7
Kazakhstan 2.5 2.2 2.5 2.8
Kenya 3.4 2.7 2.9 2.5
Korea 34.4 34.4 30.1 40.3
Kuwait 13.2 11.5 14.6 12.0
Latvia 12.4 10.8 10.8 9.4
Lebanon 6.5 5.6 6.0 4.8
Libya 4.4 4.1 4.7 4.4
Lithuania 13.4 10.1 11.2 10.5
Luxembourg 8.2 7.1 7.9 6.9
Macao S.A.R. 3.2 2.8 2.7 2.1
Macedonia, F.Y.R.O. 9.6 8.0 7.7 6.6
Malaysia 7.6 6.2 6.8 5.1
Malta 6.3 5.9 5.8 4.3
Martinique 3.9 3.7 5.0 3.7
Mauritius 4.7 4.8 5.0 4.9
Mexico 23.9 21.4 21.1 17.4
Moldova 3.3 2.0 2.1 1.6
Mongolia 1.7 1.1 1.3 1.0
Montenegro 7.7 5.3 5.7 4.6
Morocco 2.7 1.9 1.9 1.6
Mozambique — — 8.4 6.9
Nepal 2.3 2.0 2.0 1.8
Netherlands 9.0 6.1 7.3 5.8
Netherlands Antilles 3.0 2.5 2.5 2.2
New Zealand 6.6 4.9 5.7 4.9
Nicaragua 13.5 13.8 11.7 9.1
Nigeria 3.5 3.2 3.7 2.8
Norway 6.6 4.7 5.0 3.8
Oman 13.2 10.0 10.3 9.0
Pakistan 2.4 2.1 2.1 1.8
75
Country/Region 1Q10 2Q10 3Q10 4Q10
Palestinian Authority 5.1 4.5 5.0 4.8
Panama 14.5 11.5 13.6 11.7
Paraguay 4.9 5.1 4.9 3.4
Peru 16.2 19.2 16.7 13.5
Philippines 3.0 3.3 3.5 2.8
Poland 23.6 21.8 22.6 17.3
Portugal 23.0 18.1 19.3 15.6
Puerto Rico 5.0 4.0 4.4 3.6
Qatar 8.9 7.9 7.6 6.4
Réunion 2.8 2.7 4.0 3.0
Romania 6.8 5.7 7.0 5.4
Russia 12.4 11.5 11.1 10.1
Saudi Arabia 17.3 16.8 17.9 15.8
Senegal 3.4 2.6 2.4 1.9
Serbia 7.7 5.3 5.7 4.6
Singapore 9.2 8.0 11.1 11.0
Slovakia 8.8 7.6 8.3 8.5
Slovenia 14.8 10.0 9.8 9.1
South Africa 12.8 11.9 11.8 9.8
Spain 39.2 35.7 36.3 33.2
Sri Lanka 2.3 1.8 2.0 1.7
Sweden 8.0 5.2 5.9 4.4
Switzerland 5.0 4.0 4.7 4.1
Taiwan 29.3 33.5 31.7 24.3
Tanzania 4.3 3.9 4.3 3.1
Thailand 14.6 15.3 17.4 14.5
Trinidad and Tobago 5.6 5.1 6.1 4.6
Tunisia 2.5 1.8 1.9 1.6
Turkey 35.5 36.6 42.4 32.8
Uganda — — 4.4 2.8
Ukraine 4.0 3.6 3.3 3.1
United Arab Emirates 9.5 8.4 9.0 7.5
United Kingdom 7.9 6.7 7.4 8.7
United States 14.8 12.9 13.5 11.6
76
Country/Region 1Q10 2Q10 3Q10 4Q10
Uruguay 3.7 4.4 5.1 3.1
Venezuela 9.9 9.5 9.8 9.7
Vietnam 2.2 2.1 2.1 1.6
Worldwide 10.8 9.6 9.9 8.7
77
Glossary
adware
A program that displays advertisements. Although some adware can be beneficial
by subsidizing a program or service, other adware programs may display
advertisements without adequate consent.
backdoor trojan
A type of trojan that provides attackers with remote access to infected computers.
Bots are a sub- category of backdoor trojans. Also see botnet.
botnet
A set of computers controlled by a “command-and-control” (C&C) computer to
execute commands as directed. The C&C computer can issue commands directly
(often through Internet Relay Chat [IRC]) or by using a decentralized
mechanism, such as peer-to-peer (P2P) networking. Computers in a botnet are
often called nodes or zombies.
C&C
Short for command and control. See botnet.
CCM
Short for computers cleaned per mille (thousand). The number of computers
cleaned for every 1,000 executions of MSRT. For example, if MSRT has 50,000
executions in a particular location in the first quarter of the year and removes
infections from 200 computers, the CCM for that location in the first quarter of
the year is 4.0 (200 ÷ 50,000 × 1,000).
clean
To remove malware or potentially unwanted software from an infected computer.
A single cleaning can involve multiple disinfections.
78
definition
A set of signatures that can be used to identify malware by using antivirus or
antispyware products. Other vendors may refer to definitions as DAT files,
pattern files, identity files, or antivirus databases.
disclosure
Revelation of the existence of a vulnerability to a third party.
disinfect
To remove a malware or potentially unwanted software component from a
computer or to restore functionality to an infected program. Compare with clean.
downloader/dropper
See trojan downloader/dropper.
exploit
Malicious code that takes advantage of software vulnerabilities to infect a
computer or perform other harmful actions.
firewall
A program or device that monitors and regulates traffic between two points, such
as a single computer and the network server, or one server to another.
generic
A type of signature that is capable of detecting a variety of malware samples from
a specific family, or of a specific type.
IFrame
Short for inline frame. An IFrame is an HTML document that is embedded in
another HTML document. Because the IFrame loads another webpage, it can be
used by criminals to place malicious HTML content, such as a script that
downloads and installs spyware, into non-malicious HTML pages that are hosted
by trusted websites.
keylogger
A program that sends keystrokes or screen shots to an attacker. Also see password
stealer (PWS).
79
Malicious Software Removal Tool
The Microsoft Windows Malicious Software Removal Tool (MSRT) is designed to
help identify and remove specifically targeted, prevalent malware from customer
computers and is available at no charge to licensed Windows users. The main
release mechanism of MSRT is through Windows Update (WU), Microsoft
Update (MU), or Automatic Updates (AU). A version of the tool is also available
for download from the Microsoft Download Center. MSRT is not a replacement
for an up-to-date antivirus solution, because it specifically targets only a small
subset of malware families that are determined to be especially prevalent. In
addition, MSRT includes no real-time protection and cannot be used to prevent
malware from initially infecting a computer. More details about MSRT are
available at www.microsoft.com/security/malwareremove/default.mspx.
malware
Malware is any software that’s been designed specifically to cause damage to a
user’s computer, server, or network. Viruses, worms, trojans, and spyware are all
types of malware.
monitoring tool
Software that monitors activity, usually by capturing keystrokes or screen images.
It may also include network sniffing software. Also see password stealer (PWS).
payload
The actions conducted by a piece of malware for which it was created. Payloads
can include, but are not limited to, downloading files, changing system settings,
displaying messages, and logging keystrokes.
phishing
A method of credential theft that tricks Internet users into revealing personal or
financial information online. Phishers use phony websites or deceptive email
messages that mimic trusted businesses and brands to steal personally
identifiable information (PII), such as user names, passwords, credit card
numbers, and identification numbers.
80
phishing impression
A single instance of a user attempting to visit a known phishing page with
Internet Explorer 7, 8, or 9, and being blocked by the Phishing Filter or
SmartScreen filter. Also see malware impression.
pop-under
A webpage that opens in a separate window that appears beneath the active
browser window. Pop-under windows are commonly used to display
advertisements.
rootkit
A program whose main purpose is to perform certain functions that cannot be
easily detected or undone by a system administrator, such as hiding itself or
other malware.
signature
A set of characteristics that can identify a malware family or variant. Signatures
are used by antivirus and antispyware products to determine whether a file is
malicious or not. Also see definition.
social engineering
A technique that defeats security precautions by exploiting human
vulnerabilities. Social engineering scams can be both online (such as receiving
email messages that ask the recipient to click the attachment, which is actually
malware) and offline (such as receiving a phone call from someone posing as a
representative from one’s credit card company). Regardless of the method
81
selected, the purpose of a social engineering attack remains the same—to get the
targeted user to perform an action of the attacker's choice.
spam
Bulk unsolicited email. Malware authors may use spam to distribute malware,
either by attaching the malware to email messages or by sending a message
containing a link to the malware. Malware may also harvest email addresses for
spamming from compromised machines or may use compromised machines to
send spam.
spyware
A program that collects information, such as the websites a user visits, without
adequate consent. Installation may be without prominent notice or without the
user’s knowledge.
tool
Software that may have legitimate purposes but may also be used by malware
authors or attackers.
trojan
A generally self-contained program that does not self-replicate but takes
malicious action on the computer.
trojan downloader/dropper
A form of trojan that installs other malicious files to a computer that it has
infected, either by downloading them from a remote computer or by obtaining
them directly from a copy contained in its own code.
virus
Malware that replicates, typically by infecting other files in the computer, to
allow the execution of the malware code and its propagation when those files are
activated.
vulnerability
A weakness, error, or poor coding technique in a program that may allow an
attacker to exploit it for a malicious purpose.
worm
Malware that spreads by spontaneously sending copies of itself through email or
by using other communication mechanisms, such as instant messaging (IM) or
peer-to-peer (P2P) applications.
82
Threat Families Referenced in
This Report
The definitions for the threat families referenced in this report are adapted from
the Microsoft Malware Protection Center encyclopedia
(www.microsoft.com/security/portal), which contains detailed information about
a large number of malware and potentially unwanted software families. See the
encyclopedia for more in-depth information and guidance for the families listed
here and throughout the report.
83
WinNT/Citeary. A kernel mode driver installed by Win32/Citeary, a worm that
spreads to all available drives including the local drive, installs device drivers and
attempts to download other malware from a predefined website.
84
Win32/Frethog. A large family of password-stealing trojans that target
confidential data, such as account information, from massively multiplayer online
games.
Win32/Hotbar. Adware that displays a dynamic toolbar and targeted pop-up ads
based on its monitoring of Web-browsing activity.
Win32/Keygen. A generic detection for tools that generate product keys for
illegally obtained versions of various software products.
Win32/Microjoin. A generic detection for tools that bundle malware files with
clean files in an effort to deploy malware without being detected by security
software.
Win32/Parite. A family of viruses that infect .exe and .scr executable files on the
local file system and on writeable network shares.
Win32/Pdfjsc. A family of specially crafted PDF files that exploit Adobe Acrobat
and Adobe Reader vulnerabilities. Such files contain malicious JavaScript that
executes when the file is opened.
85
Win32/RealVNC. A management tool that allows a computer to be controlled
remotely. It can be installed for legitimate purposes but can also be installed from
a remote location by an attacker.
86
Win32/Vobfus. A family of worms that spreads via network drives and
removable drives and download/executes arbitrary files. Downloaded files may
include additional malware.
87
One Microsoft Way
Redmond, WA 98052-6399
microsoft.com/security
88